CVE-2026-102599

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Sep 29, 2026, 11:44:33 PM UTC

Updated

Sep 29, 2026, 11:44:34 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.58% · Oct 25, 2026

A flaw was found in engine.io. A remote attacker can cause a Denial of Service (DoS) by establishing a valid session and sending a transport upgrade request with a mismatched or omitted protocol revision parameter. This discrepancy causes the server to attach incompatible communication handlers, allowing a subsequent crafted heartbeat packet to trigger an unhandled error and crash the application process. engine.io: engine.io: Denial of Service via protocol revision mismatch during transport upgrade A flaw of IMPORTANT impact was found in the Engine.IO transport layer of Socket.IO. A remote, unauthenticated attacker can establish a valid Engine.IO session and then send a transport upgrade request with a mismatched or omitted EIO protocol revision parameter. Because the server derives the protocol revision for the upgrade from the request rather than enforcing the revision negotiated for the existing session, a transport with incompatible parser and heartbeat behavior is attached, and a subsequently crafted heartbeat packet can trigger an uncaught exception that terminates the Node.js process, causing a denial of service with no impact on confidentiality or integrity. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted EIO value is interpreted as protocol revision 3 on the affected path. Within the Red Hat portfolio, only the community-supported qt6-qtwebengine package in EPEL is affected, and a fix is being pursued for it; Red Hat-managed products, including Red Hat Enterprise Linux, RHEL AI, Red Hat In-Vehicle OS, Red Hat JBoss Fuse, and Red Hat Hardened Images, are not affected because the vulnerable code is not present in the shipped versions of those components. The Red Hat severity of IMPORTANT matches the upstream assessment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.